Cryptoasset Vault Access Control Using HSM-Authenticated Policy Maps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing custodial systems for cryptocurrencies lack secure access control mechanisms, especially for businesses requiring multiple users to access cryptoassets, and are vulnerable to breaches that can lead to theft.
Innovation Solution
A cryptoasset custodial system using hardware security modules (HSMs) with logical separation of private keys and policy maps, enforcing access control through cryptographic processing, allowing different vaults to have distinct permission schemes and quorums for approval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware wallets and cold storage are used to store cryptocurrency, then security against theft is improved, but access control for multiple users is limited
Solution Approach 1:
The system segments cryptoassets into separate vaults, each with its own access policies and key pairs. This allows different portions of assets to have different access controls, enabling multiple users to access specific vaults while maintaining security through cryptographic isolation of each segment
Solution Approach 2:
Each vault is assigned local quality attributes including unique access policies, key pairs, and control rules tailored to specific business needs. This enables granular control where different users have different levels of access to different vaults, combining security with multi-user functionality
2Adaptability or versatility
If access control mechanisms are implemented to enable multi-user access, then adaptability is improved, but security vulnerabilities increase
Solution Approach 1:
The system introduces policy maps and HSMs as intermediaries between users and cryptoassets. Policy maps define access rules that are cryptographically enforced by HSMs, creating a secure mediation layer that enables multi-user access while preventing direct access to private keys and maintaining security through cryptographic verification of access policies
3Reliability
If logical separation of private keys is implemented, then security is improved, but system complexity increases
Solution Approach 1:
The HSM is designed as a universal component that handles multiple functions including key generation, key protection, policy map authentication, and access control enforcement across multiple vaults. This multi-functionality reduces overall system complexity by consolidating security operations into a single standardized interface
Data Source
AI summary
Methods, systems, and apparatus, including medium-encoded computer program products, for secure storage and retrieval of information, such as private keys, useable to control access to a blockchain, include, in at least one aspect, a method including: receiving a request to take an action with respect to a vault of multiple different vaults in a cryptoasset custodial system; authenticating, by an HSM, the policy map for the vault based on a cryptographic key controlled by the HSM; checking, by the HSM, the action against the policy map for the vault when the policy map for the vault is authenticated based on the cryptographic key controlled by the HSM; and effecting, by the HSM, the action when the action is confirmed to be in accordance with the policy map for the vault.